- tor-project - lists.torproject.org

Visiting and speaking at Raboud Universiteit in Nijmegen this week
by isis 01 Feb '16

01 Feb '16

Hello, I'm at Raboud Universiteit in Nijmegen this week, visiting Peter Schwabe and the ICIS cryptography students. Tomorrow I'll be giving a talk to the students to explain what I work on, mostly to introduce myself so that the students can feel more comfortable talking to "the scary gothy hacker girl" about potential research/projects which they might work on on/for Tor. On Friday, I'm very excited to have the opportunity to meet and have dinner with Joan Daemen (one of the creators of the Rijndael alorithm, which is now AES). :D If there's anything I can pass along to folks here, such as project ideas which might be useful to pitch to interested students, or cryptography questions, please let me know! ----- Forwarded message from Peter Schwabe <peter(a)cryptojedi.org> ----- > From: Peter Schwabe <peter(a)cryptojedi.org> > Subject: Visit and talk by Isis Lovecruft (The Tor project) > Date: Sat, 30 Jan 2016 09:02:23 +0100 > To: icis-all(a)cs.ru.nl, kerckhoffs-students(a)science.ru.nl, students(a)true-security.nl > Cc: Isis Lovecruft <isis(a)patternsinthevoid.net> > Delivered-To: <isis(a)patternsinthevoid.net> > > Dear all, > > Next week Isis Lovecruft will be visiting our group. I know Isis from > her work for the Tor project; for those of you who don't know her, her > website is https://www.patternsinthevoid.net/. > > Isis will be around the whole week and will be giving a talk on > > Tuesday, February 2, 15:30, in room HG00.068. > > > Title: "Tor Bridges: Hiding Public Resources from Nation-State > Adversaries" > > Abstract: "After a brief overview of Tor and Tor bridges, I'll talk > about how Tor's circuit-level cryptography allows for loose-source > routing and how that can be used to protect Tor bridges from nation > state adversaries seeking to discover their location. Finally, I'll > briefly cover the design for the new Tor bridge distribution system I'm > currently working on which uses anonymous credentials to monitor Tor > bridge users' behaviour, facilitating allowing well-behaved users to > invite people in their social circle into the bridge distribution > system, as well as causing bad actors to be locked out of the system." > > > Looking forward to seeing many of you there. > > > Cheers and have a nice weekend, > > Peter ----- End forwarded message ----- -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

1 0

Meanwhile, at library conferences for coders--
by Kate 28 Jan '16

28 Jan '16

FYI- -------- Forwarded Message -------- Subject: c4l Child Care Options - Register Today Date: Tue, 26 Jan 2016 19:19:16 UT From: code4lib(a)concentra-cms.com Reply-To: code4lib(a)concentra-cms.com To: ailanthus(a)riseup.net Hello Kate Krauss, If you are planning to use the on site childcare during the 2016 Code4lib conference, you will need to sign up by January 31st. The childcare provider we are working with has asked for ample advanced notice to ensure that we secure the right number of childcare staff for each day of the conference. CHILD CARE REGISTRATION: To register please log on at Child Care Registration. For more information about the child care offered at the confernce please visit Childcare at code4lib 2016. Sincerely, Jenn Cummings & Kathy Azevedo 2016 Code4Lib Conference Planners | CONCENTRA – CMS | code4lib(a)concentra-cms.com | www.code4lib.org

5 6

Yet another work week in mood points
by Karsten Loesing 25 Jan '16

25 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello world, three weeks ago I started an experiment on an internal mailing list that I'm now moving to this public mailing list: I wrote down my current task with start and end time together with "mood points" indicating how cheerful I am while working on it. Here's the data format, to give you an example: mood_1_to_5,task,date,from_time,to_time 5,Read emails,2016-01-03,09:05,09:25,misc 5,Submit timesheet,2016-01-03,09:25,09:35,org 5,Backup bridge descriptor tarballs,2016-01-03,09:35,09:45,op 3,Write monthly report,2016-01-03,09:45,10:05,org 2,Handle org issue,2016-01-03,13:25,13:55,org ... The reason was that I felt like I'm spending a lot of time on things I don't really enjoy, but I was just not sure if that was my mind tricking me. That's why I started collecting some numbers on it, because data can't lie, right? Here are some results from the third work week of 2016. Fraction of time spent on tasks and average mood points (1 = bad, 5 = fantastic), grouped by task category, ordered by mood points: - 4% of time, 4.0 mood points: Metrics Team - 14% of time, 3.2 mood points: Other, incl. emails and IRC - 81% of time, 3.1 mood points: Software development - 1% of time, 3.0 mood points: Organizational tasks Top 3 tasks by mood points: - 4% of time, 4.0 mood points: Metrics Team meeting - 2% of time, 4.0 mood points: Evaluated last week's mood - 2% of time, 4.0 mood points: Investigate Metrics performance Bottom 3 tasks by mood points: - 9% of time, 3.0 mood points: Metropolitan France is unused (#17786) - 5% of time, 3.0 mood points: Discussed adding CIs to hidserv graphs - 3% of time, 3.0 mood points: Problems with meek user stats Some observations when comparing the last week to the weeks before: I spent even more time on software development (81%) than the in the two weeks before (41% and 69%). The main reason was that I spent incredible 57% of last week on a single development task that is neither in the top 3 nor bottom 3 (57% of time, 3.1 mood points: Metrics website cleanup). I may have ignored a thing or two while doing that. Still, more software development doesn't automatically make me more cheerful. My overall mood went down from 3.3 in the first week and 3.5 in the second week to 3.1 in week three. Maybe I should spend more time on team-related tasks. Or maybe it's the result of having to ignore non-development things while writing code. I'm planning to continue this experiment for a while. Is there anything else that people here measure about their work that I could add? Did people write articles or books about measuring such things? All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJWpe+DAAoJEJD5dJfVqbCrWfwH/iRUhYP+IZ6sGqil6JWN+AVZ Fc9E3EBzZdS8JbhPTs0+gObASvzsmucd9iYViccZoToryvx9uLCQilTUlj/Otekp K22IL+FoX9FjPL4Iuzbw0JIFMsP/T8S7Hb4Klh0Im6FDRYz3coR6y/ACKCDCtnR+ SJvqkX3xy3kLHBg2lfa9cOE6jry9ApCJUYpNclXbSz4MucemwH+4jvGtgCjME/cn 16lEqa0UhTtfIw2yUsu1ypMIxTOC4jVhDMRln/rQGM2zS0WCoFADX5ExhyyFKZ4K pG1FQOpfAbeucTf7Alz8qq2SBhdCjygbaiyzvNBRtzrTB5KWDPcFAdihoheKyBQ= =U20a -----END PGP SIGNATURE-----

1 0

Nothing To Hide Documentary
by Juris - torservers.net 21 Jan '16

21 Jan '16

Hi all, Berlin-based journalists are just running a crowdfunding campaign to finish their documentary about "mass surveillance and its widespread “I have nothing to hide” logic". Speakers: Thomas Drake, Ben Wizner, ... https://www.kickstarter.com/projects/1587081065/nothing-to-hide-the-documen… They are 1.6k EUR away from their goal and have 18 days left to reach it. Support it, if you like it! Cheers, Juris

1 0

Fwd: TorFlow
by Shari Steele 19 Jan '16

19 Jan '16

Hey all. Does anyone know who is responsible for this? https://torflow.uncharted.software/ It’s pretty cool! Shari

4 3

Community team meetings?
by Georg Koppen 19 Jan '16

19 Jan '16

Hi, I realized recently that there seem to be no community team meetings anymore (is that the case or am I just missing something?). At least not in #tor-outreach. Nor are there status reports sent to tor-reports. Is there any other way to get to know what the community team is currently discussing/planning/concerned with? Georg

1 0

Tor Dev Meeting in Jena/Germany?
by Jens Kubieziel 13 Jan '16

13 Jan '16

Hi, when I was driving back from 32C3, my wife and I spoke about having a TorDevMeeting in our home town, Jena. I shortly discussed this idea in #tor-project and decided to write a longer mail to you. Jena is located in mid-Germany (<URL:https://en.wikipedia.org/wiki/Jena>), has 110,000 citizens (a quarter being students of our two universities) and is home to Zeiss (you might know Zeiss glasses) as well as other e-commerce companies (Intershop, Demandware are the more well-known ones). It also has a nice landscape: <URL:https://upload.wikimedia.org/wikipedia/commons/8/84/Jena_Panorama.jpg> How to get here? Jena has no airport. The next airports are in Erfurt and Leipzig. However Berlin, Frankfurt/M. and Munich are a trainride (2-3 hours) away. Also several bus companies stop here (BerlinLinienBus, MeinFernbus etc.). So from my impression it is easy to get here, YMMV. Venue: There are several possible venues. Many of them belong to a university, but can be used for nearly anything (no political events). If I can find a professor who supports it the rent is cheaper or is, in some cases, free. My wife organises trade shows and might have a suggestion. She also offered in helping to organise the DevMeeting. Hotel: There are 7-8 hotels near the center of Jena. They have a total capacity of ~400 rooms. Furthermore there is another one with 160 rooms. Details can be found here: <URL:https://www.jenatourismus.de/de/jena_buchen/hotels_und_unterkuenfte/321805?lnk_hotelkategorie=336554&lnk_preiskategorie=&title=> (Anzahl der Zimmer == number of rooms, Zimmerpreis == price per room). There are, of course, some more important points for a TorDevMeeting which I'm currently not aware of. So if you like to know more or can point me to some other important points I'm happy to provide those information. What do you think? Should we move this idea forward? -- Jens Kubieziel http://www.kubieziel.de Wer Dornen sät, darf sein Zelt nicht barfuß verlassen. Werner Finck

6 6

Setup Worksheet
by Damian Johnson 12 Jan '16

12 Jan '16

Hi, couple people were curious on irc about the setup instructions I gave Shari so here they are. Might be interesting to have a 'getting started' doc available for non-developers. On the other hand though we don't bring new people on too often. Cheers! -Damian ============================================================ --------------------------------------------------------------------------- 1. Connect to IRC on Adium --------------------------------------------------------------------------- Most important thing is getting you on irc! We want to make sure you're using SSL to prevent trivial wire-tapping and registered with the Nick server. To get started connect to OFTC's SSL endpoint... ircs://irc.oftc.net:6697 Pick a nickname you like, then run... /msg nickserv register [password] [email] To claim your nick when you first connect you'll run... /msg nickserv identify [password] Adium (and later Irssi) can do this for you automatically if configured to do so. At this point you should be on irc so lets get ya on the channels important to you. There's only two... #tor-project - public organizational discussions #tor-internal - private internal channel, ask Damian for the password Other tor channels are... #nottor - off-topic banter #tor - general tor user channel #tor-dev - tor development discussions --------------------------------------------------------------------------- 2. Set up OTR --------------------------------------------------------------------------- Since we've got Adium up anyway lets look into setting up OTR. This provides an encrypted method of chatting with others. https://adium.im/help/pgs/AdvancedFeatures-OTREncryption.html The only real trick to OTR is communicating fingerprints with the people you want to talk to. Usually this is done in person, via a shared secret ('what did we talk about in person last week?'), or some other mechanism to ensure the person on the other end is who you think it is. Once a fingerprint is established it's remembered for next time. --------------------------------------------------------------------------- 3. Set up PGP --------------------------------------------------------------------------- We'll step through the commandline instructions, but there's also GUIs you'll likely find much easier to use... https://ssd.eff.org/en/module/how-use-pgp-mac-os-x Making your key with a revocation certificate just in case it gets compromised... % gpg --gen-key % gpg --output revoke.asc --gen-revoke [key] % gpg --keyserver pgp.mit.edu --send-key [key] Sending an email to someone... % gpg -r 'atagar1(a)gmail.com' -a --encrypt my_reply.txt % cat my_reply.txt.asc The thing you now see on your screen is an encrypted email only that recipient can decrypt. Receiving an email... % gpg --decrypt my_message.txt.asc Signing a document to prove it's from you... % gpg --clearsign my_reply.txt Getting someone's key... Say you get a business card with a pgp fingerprint on it. You can add their key using the following, so you can send them encrypted messages... % gpg --recv-keys 68278CC5DD2D1E85C4E45AD90445B7AB9ABBEEC6 To give this a whirl lets request a tor ldap account. This will give you a @torproject.org email address and, more importantly, access to some of our infrastructure. This is needed so we can set up Irssi another day to get ya a persistent irc connection. Look at the following ticket and do what I did... https://trac.torproject.org/projects/tor/ticket/17353 --------------------------------------------------------------------------- 4. Request access to corporate SVN --------------------------------------------------------------------------- We use an access restricted Subversion server for sensitive documents you'll need access to. To get it run the following... % htdigest -c passwd.corp "Tor Project Corporate SVN" [username you want] % htdigest -c passwd.internal "Tor Project Internal SVN" [username you want] ... and send the content of those two files to Nick in a pgp signed email. --------------------------------------------------------------------------- Follow-up tasks... --------------------------------------------------------------------------- 1a. Swap email to Riseup. 1b. Send me and Roger a notice saying what your new address is. We'll update your email list subscriptions. 2. When you have an ldap account lets meet again to get Irssi going. That'll give you a much better irc setup. 3. Nick suggests the following: confirm you have disk encryption enabled, find a password manager you like, and make sure you have backups (such as OSX's Time Machine).

2 1

Shari on Marketplace
by Kate Krauss 07 Jan '16

07 Jan '16

Hi, Shari has been doing a lot of interviews and getting a lot of positive press for Tor, but I want to point out this piece especially, which is just a great frame for our organization. Marketplace is an influential US public radio show focused on business. <http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-tuesday-…>http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-tuesday-… (starts at 4:00 mark) Onward and upward, Katie -- DONATE TO THE TOR PROJECT Join our first-ever crowdfunding campaign! https://torproject.org/donate Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

2 1

Distributed teams
by Kate Krauss 05 Jan '16

05 Jan '16

Hi, Here are a few articles I've collected about the special situation of distributed teams--I'm forwarding them in case they are useful to any of us (most of us are on such teams). They are worth a read, though each organization is different; some of these ideas would be great for Tor, while others would be terrible. 1. Work to do in person vs work to do remotely (some of these things we do already): https://modelviewculture.com/pieces/software-in-person by Sumana Harihareswara 2. From 18F, on best practices for distributed teams: https://18f.gsa.gov/2015/10/15/best-practices-for-distributed-teams/ The person I've found who has really thought through the stresses and pressures on remote workers, and what to do about this organizationally is Oktavia Jonsdottir (https://www.irex.org/person/oktavia-jonsdottir) She manages a very large, international, distributed team of people who train human rights activists to use online privacy tools under high risk, pressure, and time zones that span 14 hours (none of this is documented on the web). Her management decisions are based on peer-reviewed research as well as her direct experience as a manager. 3. Finally, this classic--The Tyranny of Structurelessness: http://www.jofreeman.com/joreen/tyranny.htm Sincerely, Kate -- DONATE TO THE TOR PROJECT Join our first-ever crowdfunding campaign! https://torproject.org/donate Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

1 0